VULNERABILITY INTELLIGENCE

CVE-2019-9709

CVSS score5.4 MEDIUM

EPSS probability0.55%

CISA KEVNot currently listed

Published2019-05-07

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

An issue was discovered in Mahara 17.10 before 17.10.8, 18.04 before 18.04.4, and 18.10 before 18.10.1. The collection title is vulnerable to Cross Site Scripting (XSS) due to not escaping it when viewing the collection's SmartEvidence overview page (if that feature is turned on). This can be exploited by any logged-in user.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Primary references

cve@mitre.org — Issue Tracking, Third Party Advisory
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory